Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
References
Link | Resource |
---|---|
https://github.com/geffner/CVE-2020-8290/blob/master/README.md | Exploit Third Party Advisory |
https://hackerone.com/reports/818857 | Permissions Required |
https://youtu.be/OpC6neWd2aM | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: hackerone
Published: 2020-12-27T01:22:39
Updated: 2020-12-27T01:22:39
Reserved: 2020-01-28T00:00:00
Link: CVE-2020-8290
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-12-27T02:15:14.573
Modified: 2020-12-31T19:25:22.013
Link: CVE-2020-8290
JSON object: View
Redhat Information
No data.
CWE